100100 secrets :
101101 type : string
102102 default : " "
103- description : secrets to use inside docker-build separated by newlines. ref: https://docs.docker.com/build/ci/github-actions/secrets/
103+ description : " secrets to use inside docker-build separated by newlines. ref: https://docs.docker.com/build/ci/github-actions/secrets/"
104104 secrets :
105105 git-ssh-key :
106106 description : SSH key used by Git to checkout the repository.
@@ -142,13 +142,11 @@ jobs:
142142 name : Build and push
143143 runs-on : ${{ fromJson(inputs.runs-on) }}
144144 steps :
145-
146145 #
147146 # Build
148147 #
149148
150- -
151- # A unique ID used to name artifacts produced.
149+ - # A unique ID used to name artifacts produced.
152150 # At least on self-hosted runners, we seem to share the workspace directory
153151 # leading to race conditions if multiple instances of this workflow are
154152 # running in parallel within the same run.
@@ -160,33 +158,28 @@ jobs:
160158 then
161159 echo "docker_login=yes" >> $GITHUB_OUTPUT
162160 fi
163- -
164- name : Checkout
161+ - name : Checkout
165162 uses : actions/checkout@v5
166163 with :
167164 ref : ${{ inputs.git-ref }}
168165 token : ${{ secrets.token }}
169166 submodules : ${{ inputs.git-submodules }}
170167 ssh-key : ${{ secrets.git-ssh-key }}
171- -
172- name : Set up Docker Buildx
168+ - name : Set up Docker Buildx
173169 uses : docker/setup-buildx-action@v3.11.1
174- -
175- if : steps.setup.outputs.docker_login == 'yes'
170+ - if : steps.setup.outputs.docker_login == 'yes'
176171 name : Docker login
177172 uses : docker/login-action@v3.6.0
178173 with :
179174 registry : ${{ inputs.registry-url }}
180175 username : ${{ secrets.registry-username }}
181176 password : ${{ secrets.registry-password }}
182- -
183- if : ${{ inputs.ssh-agent }}
177+ - if : ${{ inputs.ssh-agent }}
184178 name : Start SSH agent
185179 uses : webfactory/ssh-agent@v0.9.1
186180 with :
187181 ssh-private-key : ${{ secrets.ssh-deploy-key }}
188- -
189- if : inputs.cache == false && !inputs.ssh-agent
182+ - if : inputs.cache == false && !inputs.ssh-agent
190183 name : Build (no cache)
191184 uses : docker/build-push-action@v6.18.0
192185 with :
@@ -198,8 +191,7 @@ jobs:
198191 build-args : ${{ inputs.build-args }}
199192 secrets : ${{ inputs.secrets }}
200193 outputs : type=docker
201- -
202- if : inputs.cache == true && !inputs.ssh-agent
194+ - if : inputs.cache == true && !inputs.ssh-agent
203195 name : Build (with cache)
204196 uses : docker/build-push-action@v6.18.0
205197 with :
@@ -213,8 +205,7 @@ jobs:
213205 outputs : type=docker
214206 cache-from : type=registry,ref=${{ inputs.registry-url }}/${{ inputs.name }}:${{ inputs.cache-tag }}
215207 cache-to : type=registry,ref=${{ inputs.registry-url }}/${{ inputs.name }}:${{ inputs.cache-tag }},mode=max,ignore-error=true
216- -
217- if : inputs.cache == false && inputs.ssh-agent
208+ - if : inputs.cache == false && inputs.ssh-agent
218209 name : Build (no cache)
219210 uses : docker/build-push-action@v6.18.0
220211 with :
@@ -228,8 +219,7 @@ jobs:
228219 outputs : type=docker
229220 ssh : |
230221 default=${{ env.SSH_AUTH_SOCK }}
231- -
232- if : inputs.cache == true && inputs.ssh-agent
222+ - if : inputs.cache == true && inputs.ssh-agent
233223 name : Build (with cache)
234224 uses : docker/build-push-action@v6.18.0
235225 with :
@@ -250,17 +240,15 @@ jobs:
250240 # Vulnerability scan
251241 #
252242
253- -
254- name : Configure Python
243+ - name : Configure Python
255244 uses : actions/setup-python@v6
256245 with :
257- python-version : ' 3.11'
258- -
259- if : inputs.trivy-enabled && inputs.trivy-summary-enabled
246+ python-version : " 3.11"
247+ - if : inputs.trivy-enabled && inputs.trivy-summary-enabled
260248 name : Scan for vulnerabilities (table format)
261249 uses : aquasecurity/trivy-action@0.33.1
262250 with :
263- exit-code : ' 0 '
251+ exit-code : " 0 "
264252 hide-progress : false
265253 ignore-unfixed : ${{ inputs.trivy-ignore-unfixed }}
266254 image-ref : ${{ inputs.name }}:${{ steps.setup.outputs.unique-id }}
@@ -272,8 +260,7 @@ jobs:
272260 env :
273261 TRIVY_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-db
274262 TRIVY_JAVA_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-java-db
275- -
276- if : inputs.trivy-enabled && inputs.trivy-summary-enabled
263+ - if : inputs.trivy-enabled && inputs.trivy-summary-enabled
277264 name : Post all scan results to Github Summary as a table
278265 env :
279266 CODE_BLOCK : " ```"
@@ -283,25 +270,23 @@ jobs:
283270 echo $CODE_BLOCK >> $GITHUB_STEP_SUMMARY
284271 cat ${{ steps.setup.outputs.unique-id }}-trivy-scan-result.txt >> $GITHUB_STEP_SUMMARY
285272 echo $CODE_BLOCK >> $GITHUB_STEP_SUMMARY
286- -
287- if : inputs.trivy-sbom-enabled
273+ - if : inputs.trivy-sbom-enabled
288274 name : Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
289275 uses : aquasecurity/trivy-action@0.33.1
290276 with :
291277 format : github
292278 hide-progress : false
293- output : ' dependency-results.sbom.json'
279+ output : " dependency-results.sbom.json"
294280 image-ref : ${{ inputs.name }}:${{ steps.setup.outputs.unique-id }}
295281 github-pat : ${{ secrets.GITHUB_TOKEN }}
296282 env :
297283 TRIVY_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-db
298284 TRIVY_JAVA_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-java-db
299- -
300- if : inputs.trivy-enabled
285+ - if : inputs.trivy-enabled
301286 name : Scan for vulnerabilities
302287 uses : aquasecurity/trivy-action@0.33.1
303288 with :
304- exit-code : ' 0 '
289+ exit-code : " 0 "
305290 format : json
306291 hide-progress : false
307292 ignore-unfixed : ${{ inputs.trivy-ignore-unfixed }}
@@ -314,8 +299,7 @@ jobs:
314299 env :
315300 TRIVY_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-db
316301 TRIVY_JAVA_DB_REPOSITORY : public.ecr.aws/aquasecurity/trivy-java-db
317- -
318- if : inputs.trivy-enabled
302+ - if : inputs.trivy-enabled
319303 name : Parse vulnerability scan results
320304 continue-on-error : ${{ inputs.trivy-error-is-success }}
321305 shell : python
@@ -348,8 +332,7 @@ jobs:
348332 print("Raw results:")
349333 json.dump(data, sys.stdout)
350334 sys.exit(exit_code)
351- -
352- if : inputs.trivy-enabled && inputs.trivy-error-is-success
335+ - if : inputs.trivy-enabled && inputs.trivy-error-is-success
353336 name : Test results
354337 run : |
355338 test "x${{ steps.parse.outputs.exit-code }}" = "x2"
@@ -358,15 +341,13 @@ jobs:
358341 # Push
359342 #
360343
361- -
362- name : Build list of additional tags
344+ - name : Build list of additional tags
363345 id : additional-tags
364346 uses : actions/github-script@v8.0.0
365347 with :
366348 script : |
367349 core.setOutput('tags', `${{ inputs.tag-extra }}`.split(",").join("\n"))
368- -
369- name : Generate image tags
350+ - name : Generate image tags
370351 uses : docker/metadata-action@v5
371352 id : meta
372353 with :
@@ -378,8 +359,7 @@ jobs:
378359 type=raw,value=${{ github.sha }},enable=${{ inputs.tag-sha }}
379360 type=raw,value=latest,enable=${{ inputs.tag-latest }}
380361 ${{ steps.additional-tags.outputs.tags }}
381- -
382- if : inputs.push && steps.setup.outputs.docker_login == 'yes'
362+ - if : inputs.push && steps.setup.outputs.docker_login == 'yes'
383363 name : Push tags
384364 id : push
385365 run : |
0 commit comments